In modern releases of macOS, Apple enforces a strict privacy framework known as Transparency, Consent, and Control (TCC). Under this security model, applications are sandboxed from accessing sensitive user directories—including Messages history, Apple Mail databases, Safari browsing sessions, Time Machine backups, and system files—unless explicitly granted Full Disk Access by the user.
While developer tools (like Terminal, iTerm2, and VS Code), cloud synchronisation clients (like Dropbox and Google Drive), and system backup utilities require Full Disk Access to operate, granting unrestricted drive access to unknown utilities poses severe security risks. Auditing and managing these permissions in macOS ensures your system remains secure while preventing permission errors.
How to Access the Full Disk Access Control Panel
To inspect which applications currently hold full drive access on your Mac:
- Click the Apple menu () in the top-left corner of your screen and select System Settings.
- Scroll down the left-hand navigation sidebar and click Privacy & Security.
- Scroll through the right-hand panel and click Full Disk Access.
macOS displays a complete list of all installed software that has requested or obtained comprehensive file system rights.
Granting Full Disk Access to a New Application
If an app (such as a terminal emulator, disk cleaner, or developer IDE) fails to read files or displays an error stating “Operation not permitted”:
- In the Full Disk Access window, locate the application in the list.
- Toggle the switch next to the app to the On position.
- When prompted, authenticate using Touch ID or enter your administrator password.
- If the app does not appear in the list, click the plus (+) button at the bottom of the table, navigate to your Applications folder, select the app, and click Open.
- macOS will display a prompt: “[App Name] will not have full disk access until it is quit.” Click Quit & Reopen to apply the new security entitlement immediately.
Revoking Full Disk Access from Decommissioned Apps
To maintain strong endpoint security, periodically audit your Full Disk Access list and revoke access from apps you no longer actively use:
- Temporary Revocation: Simply toggle the switch next to the app to the Off position.
- Permanent Removal: Select the app row and click the minus (–) button at the bottom of the list to remove its security profile completely.
Restricting full disk access to only essential, trusted software protects your private documents, communications, and system files from unauthorised inspection.